The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content through the following evidence chain:
Ingestion points: In SKILL.md, the plan to be reviewed is resolved from conversation text, explicit file paths, or by globbing markdown files in the .turbo/plans/ directory.
Boundary markers: The instructions for passing the plan to the Structure, Scope, and Peer Review agents do not specify the use of delimiters (e.g., XML tags) or explicit instructions to disregard potentially malicious directives embedded within the plan text.
Capability inventory: The subagents are granted capabilities to create git worktrees, perform dependency installations, and execute arbitrary test runners as defined in Step 2 of SKILL.md.
Sanitization: There is no evidence of sanitization, escaping, or filtering of the external plan content before it is interpolated into the prompts for the subagents.
[DYNAMIC_EXECUTION]: The skill instructs subagents to perform feasibility checks that involve "its own dependency install" and starting "every test runner" in a temporary git worktree under $TMPDIR. This constitutes the execution of code and installation of packages that may be defined or modified by the untrusted plan being reviewed.
[COMMAND_EXECUTION]: The skill leverages complex shell commands and tool calls to manage isolated execution environments, including:
Use of git worktree, git status, and git show to manipulate the repository state without altering the current HEAD.
Management of process groups and external timeouts to ensure that test runners and their child processes are correctly terminated during teardown.

review-plan